This Data Processing Agreement (hereinafter referred to as the Agreement) sets out the terms on which Private Entrepreneur under the laws of Ukraine Serdiukova Anna (hereinafter referred to as the Administration or the Processor) processes the personal data of the clients and employees of a User of the PodoCard service on behalf of and on the instructions of that User when providing the Service.
The Agreement supplements the Terms of Use of the PodoCard service and the Privacy Policy published on the website https://podocard.com, and applies together with them. The Agreement is a contract of adhesion within the meaning of Article 634 of the Civil Code of Ukraine. The User accedes to the Agreement (accepts it) when they accept the Terms of Use and enter personal data of the User's Clients or the User's Employees into the Service, including when they enable the acceptance of appointments via the Online Booking Page.
The Agreement has been drawn up in accordance with the Law of Ukraine ‘On the Protection of Personal Data’ dated 01.06.2010 No. 2297-VI and, for Users who are subject to the General Data Protection Regulation (EU) 2016/679 (GDPR), also in accordance with Article 28 of the GDPR.
Last updated: 29 October 2026.
SECTION 1: TERMINOLOGY
The Agreement uses the terms of the Terms of Use and the Privacy Policy (including ‘Service’, ‘Website’, ‘User’, ‘User's Client’, ‘Client Profile’, ‘CRM Features’, ‘Online Booking Page’, ‘User's Employee’), as well as the following terms:
‘Controller’ — the User who is the owner of a company in the Service or, if the company's account space is maintained for a legal entity or an individual entrepreneur, that person. The Controller determines the purposes and means of the processing of the Entrusted Data and, in the terminology of the Law of Ukraine ‘On the Protection of Personal Data’, is the owner of such data.
‘Processor’ — the Administration, which processes the Entrusted Data on behalf of and on the instructions of the Controller; in the terminology of the Law of Ukraine ‘On the Protection of Personal Data’, the holder of personal data.
‘Entrusted Data’ — personal data of the User's Clients and the User's Employees that is entered into the company's account space by the Controller, the User's Employees or the User's Clients themselves via the Online Booking Page and that the Processor processes on the instructions of the Controller. The composition of such data is set out in Appendix 1.
‘Data Subject’ — a natural person to whom the Entrusted Data relates.
‘Sub-processor’ — a third party engaged by the Processor in the processing of the Entrusted Data.
‘Incident’ — a breach of security that has led to the accidental or unlawful destruction, loss, alteration or unauthorised disclosure of, or unauthorised access to, the Entrusted Data.
‘Data Protection Legislation’ — the Law of Ukraine ‘On the Protection of Personal Data’, as well as the GDPR and other laws on the protection of personal data, if they apply to the Controller.
SECTION 2: SUBJECT MATTER AND SCOPE OF THE AGREEMENT
2.1. The Controller instructs the Processor, and the Processor undertakes, to process the Entrusted Data solely in order to provide the Service to the Controller in accordance with the Terms of Use, to provide technical support for the Service and to protect it. The nature and purposes of the processing, the categories of data and of Data Subjects, and the duration of the processing are specified in Appendix 1.
2.2. The Agreement does not apply to personal data the purposes and means of processing of which are determined by the Administration itself as the owner (controller): the account data of Users, including that of the User's Employees as users of the Service; data on subscription payments; technical information, cookies and analytics data; data of participants in the partner (referral) programme. The processing of such data is governed by the Privacy Policy.
2.3. In the event of a conflict between the Agreement and the Terms of Use or the Privacy Policy with regard to the processing of the Entrusted Data, the provisions of the Agreement shall apply.
SECTION 3: OBLIGATIONS OF THE CONTROLLER
3.1. The Controller independently determines the purposes of the processing of the Entrusted Data and is responsible for its lawfulness, including for:
the existence of an appropriate legal basis for the processing, including the consent of the User's Clients to the processing of information about their health, photographs and signatures, where such consent is required by law;
informing Data Subjects of the purposes, scope and periods of the processing of their data, as well as of the fact that the data is processed using the Service;
ensuring that the data entered is accurate and up to date and corresponds to the purposes of the processing.
3.2. Instructions given by the Controller to the Processor must comply with the Data Protection Legislation.
3.3. The Controller assigns roles and branches to the User's Employees in such a way that their access to data corresponds to the work they perform, and deactivates or deletes, in a timely manner, the accounts of the User's Employees who have stopped working. Actions of the User's Employees in the company's account space are deemed to be actions of the Controller.
3.4. The Controller ensures the protection of the passwords and devices with which the Controller and the User's Employees log in to the Service, and is responsible for the Entrusted Data obtained from the Service: the export, PDF documents, photographs and other downloaded files.
3.5. The Controller independently considers requests from Data Subjects and fulfils them (Section 7).
SECTION 4: OBLIGATIONS OF THE PROCESSOR
4.1. The Processor processes the Entrusted Data only on documented instructions from the Controller, including with regard to transfers of data abroad (Section 9), unless otherwise required by the legislation to which the Processor is subject. In such a case, the Processor informs the Controller of that requirement before the processing begins, unless the law prohibits such information.
4.2. The documented instructions of the Controller are: the Agreement and the Terms of Use; actions of the Controller and the User's Employees in the Service (entering, changing and deleting data, company and branch settings, enabling CRM Features and the Online Booking Page, sending documents to clients); written requests from the company owner to the support service at support@podocard.com, including a request for a data export. Other instructions are carried out if they are technically feasible within the Service and agreed by the parties.
4.3. The Processor immediately informs the Controller if, in its opinion, an instruction of the Controller infringes the Data Protection Legislation.
4.4. The Processor does not use the Entrusted Data for its own purposes, including marketing purposes, does not sell it and does not transfer it to third parties, except to Sub-processors (Section 6) and in the cases provided for by law. The Processor does not send advertising messages to the User's Clients.
4.5. The Processor grants access to the Entrusted Data only to persons who need it to provide, support and protect the Service, and ensures that they have committed themselves to confidentiality or are under a statutory obligation of confidentiality. Such persons view the contents of Client Profiles only where this is necessary to handle the User's request to the support service, to fix a technical fault or to comply with legal requirements.
4.6. The Processor takes technical and organisational measures to protect the Entrusted Data (Section 5 and Appendix 3), assists the Controller in fulfilling its obligations (Sections 7 and 8) and provides the information necessary to demonstrate compliance with the Agreement (Section 10).
SECTION 5: SECURITY OF PROCESSING
5.1. Taking into account the nature of the Entrusted Data, including information about health, the Processor applies the measures specified in Appendix 3 and maintains their level throughout the term of the Agreement. The Processor may change individual measures provided that the overall level of protection of the Entrusted Data is not reduced.
5.2. Some of the measures are under the control of the Controller itself: assigning roles and branches to the User's Employees, deactivating their accounts in a timely manner, strong passwords, protection of devices, disabling online booking for a branch, a User's Employee or a client. The Controller independently assesses whether the Processor's measures are sufficient for its processing.
SECTION 6: SUB-PROCESSORS
6.1. The Controller gives the Processor a general authorisation to engage Sub-processors. The current list of Sub-processors is set out in Appendix 2.
6.2. The Processor gives notice of its intention to engage a new Sub-processor or to replace an existing one by publishing on the Website an updated Appendix 2 indicating the date from which the change takes effect, no later than 14 (fourteen) calendar days before that date.
6.3. Before the specified date, the Controller may send a reasoned objection to support@podocard.com. If the parties fail to reach agreement, the Controller may stop using the Service before the change takes effect: obtain a data export and delete the account in accordance with the procedure set out in Section 11.
6.4. If the replacement of a Sub-processor is urgently required to ensure the security or continuity of the Service, the Processor may carry it out without prior notice, provided that a comparable level of data protection is maintained, and publishes an updated Appendix 2 as soon as possible. The Controller may object to such a replacement in accordance with the procedure set out in Clause 6.3.
6.5. The Processor engages Sub-processors only on the basis of a contract that imposes on them data protection obligations no less stringent than those provided for in the Agreement, to the extent that they are applicable to the services of the Sub-processor, and is liable to the Controller for the performance of such obligations by the Sub-processors.
SECTION 7: DATA SUBJECT REQUESTS
7.1. The Service enables the Controller to fulfil requests from Data Subjects independently: to view, correct and delete the data of a client, their visits and appointments, to disable online booking for the client, and to obtain a copy of the data of the company's account space (an export) in accordance with the procedure established by the Privacy Policy.
7.2. If a request from a Data Subject is received by the Processor, the Processor does not consider it on the merits but forwards it to the owner of the relevant company, if the company can be identified from the information in the request, and informs the requester that, in order to exercise their rights, they should contact the Controller.
7.3. If the Controller is unable to fulfil a request using the tools of the Service, the Processor, at the request of the company owner, assists in its fulfilment to a reasonable extent, taking into account the nature of the processing.
SECTION 8: INCIDENTS AND ASSISTANCE TO THE CONTROLLER
8.1. The Processor notifies the Controller of an Incident immediately, without undue delay after becoming aware of it. The notification is sent to the email address of the company owner specified in the account and/or by a message in the Service.
8.2. The notification contains, to the extent that such information is known to the Processor: a description of the Incident, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken and proposed, and a contact point for obtaining further information. Information that is not known at the time of the notification is provided by the Processor in phases as it is obtained.
8.3. The Processor immediately takes reasonable measures to address the Incident and mitigate its consequences, and provides the Controller with the information necessary to notify the supervisory authority and Data Subjects. Such notifications, where required, are made by the Controller.
8.4. Taking into account the nature of the processing and the information available to it, the Processor assists the Controller with a data protection impact assessment and prior consultation with the supervisory authority, where these are required of the Controller, by providing information about the Service and the protection measures applied.
SECTION 9: PLACE OF PROCESSING AND TRANSFERS OF DATA ABROAD
9.1. The Entrusted Data is stored on servers located in the Federal Republic of Germany, in the data centres of Hetzner Online GmbH (Nuremberg, Falkenstein). Database backups are stored in a separate storage facility of the same provider in Germany. The storage location of the Entrusted Data is changed in accordance with the procedure set out in Section 6.
9.2. The Processor is registered in Ukraine. Access by the Processor's authorised persons to the Entrusted Data for the purposes of support, maintenance and protection of the Service may take place outside the European Economic Area, including from Ukraine.
9.3. If the GDPR applies to the Controller and such access constitutes a transfer of personal data to a country in respect of which the European Commission has not adopted an adequacy decision, such transfer is subject to the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two ‘Transfer controller to processor’ (hereinafter referred to as the SCCs). The SCCs are incorporated into the Agreement by reference; under them, the Controller acts as the data exporter and the Processor as the data importer. For the purposes of the SCCs: Clause 7 does not apply; under Clause 9(a), Option 2 (general written authorisation) applies, with the notice period specified in Clause 6.2 of the Agreement; the optional language in Clause 11(a) does not apply; under Clause 17, the law of the EU Member State in which the Controller is established applies or, if that law does not allow for third-party beneficiary rights, the law of the Federal Republic of Germany; under Clause 18, disputes are resolved by the courts of the EU Member State in which the Controller is established; Annexes I, II and III to the SCCs are deemed to be completed with the information in Appendices 1, 3 and 2 to the Agreement respectively. In the event of a conflict between the Agreement and the SCCs, the SCCs prevail.
SECTION 10: INFORMATION AND AUDITS
10.1. At the request of the company owner, the Processor provides the information necessary to demonstrate compliance with the Agreement: a description of the protection measures applied, the list of Sub-processors, information on the certification of the infrastructure provider, and answers to reasonable questions of the Controller about the processing of the Entrusted Data.
10.2. If such information is insufficient or an audit is required by the supervisory authority, the Controller may carry out an inspection (audit) of the processing of the Entrusted Data itself or by engaging an independent auditor bound by a confidentiality obligation. The audit is carried out no more than once every 12 (twelve) months, unless it is prompted by an Incident or a requirement of the supervisory authority, with notice to the Processor of at least 30 (thirty) calendar days, during business hours, without access to the data of other users of the Service and at the expense of the Controller. The infrastructure of Sub-processors is audited on the basis of their reports and certificates.
SECTION 11: TERM, RETURN AND DELETION OF DATA
11.1. The Agreement enters into force upon acceptance and remains in force for as long as the Processor processes the Entrusted Data of the Controller, until such data is deleted in accordance with this Section.
11.2. Clients, visits and calendar appointments deleted in the Service by the Controller or the User's Employees are moved to the archive and may be restored within 30 (thirty) calendar days. After that period expires, they are deleted automatically without the possibility of recovery, together with the photographs and documents relating to them. However, calendar appointments for which payments have been recorded are not deleted; they remain stored in the company's account space and, after the client has been deleted, are no longer linked to that client.
11.3. The copy of the email address and first name of the User's Client from the form on the Online Booking Page that is stored for sending visit reminders is deleted 30 (thirty) days after the start of the visit.
11.4. Before the data is deleted, the company owner may obtain a copy of the data of the company's account space (an export) free of charge. The composition, format and procedure of the export are established by the Privacy Policy.
11.5. If the company owner deletes their account, the company's account space and all Entrusted Data are deleted without the possibility of recovery after 7 (seven) calendar days from the moment the deletion request is confirmed. Before that period expires, the request may be cancelled in accordance with the procedure established by the Terms of Use.
11.6. If access to the Service has ended upon expiry of the trial period or a paid period and the account has not been deleted, the Entrusted Data is retained so that the Controller can restore access: for 2 (two) months from the end of the trial period if no paid subscription has been purchased, or for 2 (two) years from the end of the last paid period. After these periods expire, the data is deleted automatically without the possibility of recovery. A Controller who does not wish such retention may delete the account at any time in accordance with the procedure set out in Clause 11.5.
11.7. The Entrusted Data is deleted from backups as the backups are replaced according to schedule. Until then, the backups are protected by the same measures and are used only to restore the Service after failures.
11.8. If the law requires the Processor to retain certain Entrusted Data further, the Processor retains such data only for the prescribed period, ensures its confidentiality and does not process it for any other purposes.
SECTION 12: LIABILITY
12.1. The parties are liable for breach of the Agreement in accordance with the applicable law. The limitations of liability established by the Terms of Use apply to the Agreement to the extent permitted by the Data Protection Legislation and do not limit the rights of Data Subjects.
SECTION 13: FINAL PROVISIONS
13.1. The Administration may amend the Agreement by publishing a new version on the Website indicating the date of the last update. Changes to the list of Sub-processors are made in accordance with the procedure set out in Section 6. Continued use of the Service after the new version enters into force constitutes agreement with it. If the User does not agree, the User may stop using the Service and delete the account.
13.2. The Agreement is governed by the legislation of Ukraine, subject to the mandatory rules of the Data Protection Legislation applicable to the Controller and to Section 9. Disputes are resolved in accordance with the procedure established by the Terms of Use.
13.3. Notices to the Controller are sent to the email address of the company owner specified in the account or by a message in the Service; notices to the Processor are sent to support@podocard.com.
13.4. The invalidity of any individual provision of the Agreement does not entail the invalidity of its remaining provisions.
APPENDIX 1: DESCRIPTION OF THE PROCESSING
1. Categories of Data Subjects:
the User's Clients, including persons who have booked an appointment via the Online Booking Page;
the User's Employees, in respect of the data entered into the Service by the company.
2. Categories of Entrusted Data:
data of the User's Clients: surname, first name, patronymic, gender, date of birth, occupation; phone number, email address, Telegram and Instagram contacts; medical questionnaire (information on diseases and conditions, allergies, foot size, notes); visit history (descriptions of procedures, marks on foot diagrams, information on corrective systems, notes, photographs, including before and after procedures); electronic signatures and signed documents, including informed consents in PDF format; other information and files entered by the Controller;
when CRM Features are used: appointments (date and time, branch, specialist, services and their prices, appointment status, comments), information on appointment payments (amount, payment method, date) and on settlements with clients, permission for the client to book appointments via the Online Booking Page;
when an appointment is booked via the Online Booking Page: the first name, last name, phone number and email address provided in the form, the selected services, specialist, date and time, as well as a record of consent to the processing of personal data (date and time, IP address, browser information, document version);
data of the User's Employees: first name, last name, contact details, position, photograph (avatar), role and branches, work schedule (working days and hours, breaks, days off), client appointments and services provided, terms of remuneration (a percentage of the price of services and/or a rate), if set by the Controller, and the remuneration amounts calculated on that basis.
3. Special categories of data: information about the health of the User's Clients (medical questionnaire, descriptions of procedures, photographs). The extent of their processing is determined by the Controller.
4. Nature of the processing: collection, including via the Online Booking Page; recording, systematisation, storage and alteration; display to users of the company's account space in accordance with their roles and branches; generation of PDF documents, reports and calculations; sending emails, namely documents to a client at their email address, emails about appointments and visit reminders to the User's Clients, and notifications of appointments made via the Online Booking Page to the company owner and to the managers and administrators of the branch; display of the first name, last name, position and photograph of specialists on the Online Booking Page; protection against abuse; backup; export; deletion.
5. Purposes of the processing: providing the Service and its features to the Controller, technical support for the Controller, ensuring the security and continuity of the Service, recovery after failures.
6. Duration of the processing: for the term of the Agreement (Section 11).
APPENDIX 2: SUB-PROCESSORS
This list is effective from 29 October 2026.
Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) — cloud infrastructure of the Service: servers, database, storage for photographs and documents, backups. Place of processing: Germany (data centres in Nuremberg and Falkenstein).
The Service's emails, including those to the User's Clients, are sent via the Processor's own mail server. The payment providers, app stores and analytics services referred to in the Privacy Policy are not Sub-processors: they receive only the User's data necessary to perform their functions and have no access to Client Profiles.
APPENDIX 3: TECHNICAL AND ORGANISATIONAL MEASURES
1. Hosting. The Service's servers and backups are hosted in the data centres of Hetzner Online GmbH in Germany. The provider's information security management system is certified to the international standard ISO/IEC 27001.
2. Protection of data in transit. Data exchange between the mobile application, the website and the Service's servers takes place only over a secure connection (HTTPS/TLS).
3. File storage. Photographs and documents are kept in a private storage and are not available via permanent direct links: the application provides access to them through temporary links with a limited validity period.
4. Access to infrastructure. The database is not accessible from the Internet. Administrative access to the servers is available only to the Processor's authorised technical personnel using key-based authentication.
5. Accounts. Passwords are stored only as cryptographic hashes. Access to the Service is granted by means of tokens with a limited validity period; after a password reset, previously issued tokens are revoked. The number of attempts to log in and to enter confirmation codes is limited.
6. Access control. Company data is accessible only to users of its account space. The scope of access of the User's Employees is determined by their role (owner, manager, administrator, specialist) and, when CRM Features are used, also by the branches to which they are assigned; in particular, a specialist is not shown the contact details of the User's Clients. Roles and branch assignments are set by the company owner and managers.
7. Processor's personnel. Persons granted access to the Entrusted Data are obliged to maintain confidentiality and view the contents of Client Profiles only in the cases specified in Clause 4.5 of the Agreement.
8. Online Booking Page. The number of requests and booking submissions is limited per IP address, phone number and email address; these values are used in hashed form in temporary counters, which are deleted automatically when the restriction period expires. The link for cancelling an appointment contains an unguessable code; only its hash is stored in the database. Meta Pixel and other advertising and analytics tools are not used on the Online Booking Page or on the appointment cancellation page.
9. Logs. Errors and failures are recorded in logs to monitor the operation of the Service; passwords, tokens and confirmation codes are masked in the logs.
10. Backup. Database backups are created regularly and stored in a separate storage facility in Germany.
11. Deletion. Deleted clients, visits and appointments are kept in the archive for 30 (thirty) calendar days, after which they are deleted automatically; the data of the company's account space is deleted automatically when the retention periods expire (Section 11 of the Agreement).
12. Export. A copy of the data of the company's account space is provided only to the company owner: the download link is sent only to the email address in their account and is valid for 7 (seven) calendar days, after which the archive is deleted from the Service's servers.
DETAILS
Private Entrepreneur under the laws of Ukraine Serdiukova Anna
TIN 3117915209
Tel. +380731234011
E-mail: support@podocard.com